{"_canonicalization":{"envelope_id":"axm_ + sha256(envelope minus {signature, axiom_id, anchors})","envelope_signature":"ed25519(envelope minus {signature, axiom_id})","json":"sort_keys=True, separators=(',',':'), ensure_ascii=False, allow_nan=False, utf-8","leaf_hash":"sha256(0x00 || canonical_json(envelope_full))","seal_signature":"ed25519(seal minus {signature, sig_algorithm})"},"axiom_id":"axm_c7bd2f926e87bc2e177c8b64dadf0f49a1501815c2780d73ee08c15fb5b66483","bitcoin_anchor":{"bitcoin_attestations":[],"calendar_attestations":[],"ots_url":"","stamped_at":"","status":"pending_next_stamp"},"envelope":{"anchors":[{"chain":"crovia.axiom_graph","height":0,"merkle_proof":"spider_vendor_press_v1","root_at_anchor":"spider_vendor_press_v1"}],"axiom_id":"axm_c7bd2f926e87bc2e177c8b64dadf0f49a1501815c2780d73ee08c15fb5b66483","axiom_type":"AX.OBS","body":{"axiom_subtype":"news.vendor_press.v1","category":"news","fingerprint":"28eb842a58bc0c836fdaf35894fc99c25d9d762b5574d3f107e841afe078d343","published":"Mon, 25 May 2026 00:00:00 -0400","receipt_hash":"28eb842a58bc0c836fdaf35894fc99c25d9d762b5574d3f107e841afe078d343","schema":"spider.news.vendor_press.v1","spider":"vendor_press","spider_record":{"axiom_subtype":"news.vendor_press.v1","category":"news","decision_hint":"POSITIVE","envelope_target":"AX.OBS","fingerprint":"28eb842a58bc0c836fdaf35894fc99c25d9d762b5574d3f107e841afe078d343","observed_at":"2026-05-25T04:43:48.841018Z","parent_run_hash":"56713422f06ad87427cd8cdcdb1ed341feb016b33c37198d9b168328d1df15fb","published":"Mon, 25 May 2026 00:00:00 -0400","runtime_version":"0.1.0","schema":"spider.news.vendor_press.v1","source_status":200,"source_url":"https://export.arxiv.org/rss/cs.AI","spider":"vendor_press","summary_excerpt":"arXiv:2604.24920v3 Announce Type: replace-cross \nAbstract: Agentic systems increasingly act with user secrets for APIs, messaging platforms, and cloud services. Today's agent runtimes typically implement authorization by exposure: enabling action often means placing a reusable secret, or a reusable artifact derived from it, inside the runtime, so a transient prompt-injection or tool-side compromise becomes durable account compromise. Existing defenses cover adjacent pieces such as secret storage, scoped delegation, sender-constrained tokens, and runtime monitoring, but leave the combined agentic obligation without a common specification: an untrusted autonomous requester should be able to cause a user-authorized secret-backed operation without gaining reusable authority over it. We formalize this as the Agent Secret Use (ASU) problem and identify seven security properties any solution must satisfy, spanning authorization integrity and secret confidentiality. We propose the Secret-Use D","title":"SUDP: Secret-Use Delegation Protocol for Agentic Systems","url":"https://arxiv.org/abs/2604.24920","vendor":"arxiv_cs_ai"},"summary":"arXiv:2604.24920v3 Announce Type: replace-cross \nAbstract: Agentic systems increasingly act with user secrets for APIs, messaging platforms, and cloud services. Today's agent runtimes typically implement authorization by exposure: enabling action often means placing a reusable secret, or a reusable artifact derived from it, inside the runtime, so a transient prompt-injection or tool-side compromise becomes durable account compromise. Existing defenses cover adjacent pieces such as secret storage, scoped delegation, sender-constrained tokens, and runtime monitoring, but leave the combined agentic obligation without a common specification: an untrusted autonomous requester should be able to cause a user-authorized secret-backed operation without gaining reusable authority over it. We formalize this as the Agent Secret Use (ASU) problem and identify seven security properties any solution must satisfy, spanning authorization integrity and secret confidentiality. We propose the Secret-Use D","title":"SUDP: Secret-Use Delegation Protocol for Agentic Systems","vendor":"arxiv_cs_ai"},"confidence":{"method":"deterministic"},"decision":"POSITIVE","issued_at":"2026-05-25T04:43:48Z","notes":"Spider vendor_press (news) news.vendor_press.v1","object":{"captured_by":"crovia.spider.vendor_press","primary_source_url":"https://arxiv.org/abs/2604.24920"},"predecessors":[],"schema":"crovia.axiom.v1","signature":"ed25519:704e784fef6d0fd01cf7e4cecc14d03dcb643c18bde6745e877b362c8d05d7c3e74a9f1073ae19b9356208767bd95f2d85030e18e9a610545d4197f0f99f0802","signer":"crovia.substrate","subject":{"observed_at":"2026-05-25T04:43:48Z","source_collector":"spider:vendor_press","target_id":"https://arxiv.org/abs/2604.24920"},"tsa":{"authority":"crovia.substrate.bootstrap","rfc3161_token":"{\"kind\":\"crovia.bootstrap.tsa\",\"source_jsonl\":\"/opt/crovia/spider/data/news/vendor_press_v1.jsonl\",\"source_seal_merkle_root\":\"spider_vendor_press_v1\",\"upgrade_path\":\"Sessione H \\u2014 OpenTimestamps weekly anchor\"}"},"zk_mode":"clear","zk_proof":null},"ledger":{"leaf_hash":"9c071e280be9ab6999e9ca67a4af047234190094a8a7b0016c14362e41e3c4b9","leaf_index":149750,"ledger_path":"/opt/crovia/substrate/axiom_ledger.jsonl"},"merkle_proof":{"hash_alg":"sha256","leaf_prefix":"0x00","node_prefix":"0x01","odd_leaf_rule":"duplicate_last","path":[{"sibling":"0779c8f382158b1fb586d67e78cca35fc9589eb4229c3c907ad11ccc8537aaff","side":"right"},{"sibling":"dbe38a0679bffc16cbbaddaa399b69bb6f9c0353074b3a569ee4855a8744cffa","side":"left"},{"sibling":"ba4899382e6ce1ad9b2edaedc06004ceacd650c832e6391ca70b28547ccae5ae","side":"left"},{"sibling":"c6e72543a435326972f15231e271f6d69b99709ea7f3b77ceff2809f83f05870","side":"right"},{"sibling":"2b3bb63503691b69feadf67374d3b1f5c8c9470823bc18f151aba03919ccd87d","side":"left"},{"sibling":"f4d732126f5433063a27ed518354e49a3c94e9c4c015a328c34b22b871d62002","side":"left"},{"sibling":"9a9dec70c246f07136fd93efad0647d42e469fcfca31c6741dcb1d715bd9ce45","side":"left"},{"sibling":"cb71a04113e54ec457f452a34b2778696e1747afe98ba9da255ce1f5fd8619d7","side":"left"},{"sibling":"e044acc52c31efe134c902c984299ea3452b42df993d096ed61ad8be9d530bbc","side":"right"},{"sibling":"6be461ecf12dedf98a31921aa7b5c32d4a32df6897e0f697b8bf1a4ba3e2d324","side":"right"},{"sibling":"c2861a8cef3eb66bf2726aa377c24a6bf6e8b7489dcd0e870b61d62a35ccadfb","side":"right"},{"sibling":"134949308b15cffd6792ee2cf678119af34d69a64764d7c89cd47573c94e1cda","side":"left"},{"sibling":"debbc1a6232ea7970009b91bdc2345041b2de5ac59551f955855d579001e512c","side":"right"},{"sibling":"216869846f40bd905626884f58cb67b9019e488b3656946a7808c436ab7339ac","side":"right"},{"sibling":"35ca36cee447f0ef7064a25d55f59357c66901e31427729c4c1d8b14aa8adb6c","side":"left"},{"sibling":"e734b0c6d6d13acb5f4cf00367b3913e5bbf1aa717377aa4e4820c6de24b7673","side":"right"},{"sibling":"4bbb7f78e96179bb9cdd06d7207b66b3503ab68e4880438263025b04ebe8f7ec","side":"right"},{"sibling":"d841ad93efda0869e5eb97678f348f03f5caab4353e05ff4bf18f47fb945b822","side":"left"}]},"schema":"crovia.axiom_proof.v1","seal":{"first_collector_run_id":"","first_receipt_hash":"","jsonl_path":"/opt/crovia/substrate/axiom_ledger.jsonl","key_id":"430895f101d38164","last_collector_run_id":"","last_receipt_hash":"","leaf_count":149835,"merkle_root":"51484a548bc0cf3d178eec868e98935c87f0aa83369143b7c96b048585e5ba01","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","run_id":"hourly_json_retrofit_20260525T053701Z","schema":"crovia.seal.v1","seal_family_version":"crovia-seal-family/1","seal_kind":"substrate_batch","sealed_at":"2026-05-25T05:37:33Z","sig_algorithm":"ed25519","signature":"99a657e53a015ace0bade5d7fbb3f60f950b6d1e1128251a63afcc454a492422cae5efdc0c18503b4f7e62f371bd48f2889be78d9048c4681d6c1e73f754d705","signer_version":"1.1.0"},"trust_root":{"key_id":"430895f101d38164","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","signature_algorithm":"ed25519","url":"/registry/canon/TRUST_ROOT.md"},"verifier":{"spec":"/registry/canon/AXIOM_RECEIPT_v1.md","url":"/v/axm_c7bd2f926e87bc2e177c8b64dadf0f49a1501815c2780d73ee08c15fb5b66483"}}